Privacy Policy

1. Who I am

This website is run by Studio Fabi, the creative studio of Fabian de Vries, based in Amsterdam and registered with the Dutch Chamber of Commerce (KvK 97244740). I am responsible for the personal data processed through this website and in my work with clients.

Questions about your data, or want to use one of your rights? Email me at the address in the footer of this website. I reply within one month.

2. What this policy covers

This policy explains which personal data I process when you visit studiofabi.com, request my availability, get in touch or work with me: what I collect, why, on what legal basis, who else handles it and how long I keep it.

3. Availability requests

When you check my availability and send a request, I receive:

• your name and email address;
• your company and phone number, if you fill them in;
• the dates you selected and what you tell me about the project;
• whether you would like me to call you back.

I use this to answer your request, plan the work and send you a proposal. The legal basis is taking steps at your request before entering into an agreement (Article 6(1)(b) GDPR). The request reaches me by email. If no project follows, I delete it within 12 months.

4. Email, phone and clients

When you email or call me, I process your contact details and what you send me, to reply and keep track of our conversation. When we work together, I also process the details needed for the agreement, the project and invoicing.

The legal bases are the performance of our agreement (Article 6(1)(b) GDPR) and, for invoices and accounting records, my legal obligation to keep them (Article 6(1)(c) GDPR). Dutch tax law requires me to keep that administration for seven years.

5. Website statistics

With your permission, this website uses Google Analytics to see how the site is used, such as which pages are visited, how visitors arrive and on which kind of device. This helps me improve the site. Google Analytics only loads after you accept it in the cookie notice; if you decline, nothing is loaded or stored.

• Data: pages visited, time on the page, referring website, approximate location (country and city), browser, device and screen size.
• Cookies: _ga and _ga_<ID>, which distinguish visits and expire after two years.
• Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any moment with “Cookie settings” in the footer.
• Provider: Google Ireland Limited. Google Analytics does not store IP addresses for visitors in the EU. Advertising features and data sharing for Google's own purposes are switched off, and statistics are kept for 14 months. Google may process data in the United States under the EU–US Data Privacy Framework.

6. Cookies and local storage

Apart from Google Analytics (only with your consent), this website stores a few small preferences in your own browser. They are needed for the site to work as you set it, are never sent to me and do not require consent.

• sf.theme: your choice of light, dark or automatic theme.
• sf.lang: your language choice.
• sf.geo: an estimate of sunrise and sunset for your time zone, used by the automatic theme. It is derived from your time zone setting, not from your location.
• sf.consent: your answer to the cookie notice.

7. Videos

Some projects include videos from YouTube or Vimeo. They are only loaded when you press play, using YouTube’s privacy-enhanced mode and Vimeo’s do-not-track setting. Once a video plays, YouTube (Google) or Vimeo receives data such as your IP address, and their own privacy policies apply.

8. Server logs

The server that hosts this website records technical information for every request: IP address, date and time, the page requested and your browser. I use these logs only to keep the website secure and to fix problems, which is my legitimate interest (Article 6(1)(f) GDPR). They are deleted after 14 days.

9. Who else handles your data

I never sell your data. Some providers process it on my behalf, under data processing terms:

• Hosting: Oracle Cloud Infrastructure, for the server running this website.
• Email delivery: Resend, which delivers availability requests and system emails from servers in the EU.
• Statistics: Google, only if you gave consent (see section 5).

For client work, invoices and accounting records are shared with my accountant and the Dutch Tax Administration where the law requires it.

10. Security

I protect personal data with measures that fit the risk: an encrypted connection (HTTPS) for the whole website, access to the content management system only with two-factor authentication, up-to-date software and regular backups.

11. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw that consent at any time, without affecting what happened before.

To use your rights, email me at the address in the footer. If you are not satisfied with how I handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

12. Changes

I update this policy when the website or my way of working changes. The date at the top shows when it last changed.